StackRadar

CVE-2026-35204

High

Advisory

Published 10 Apr 2026In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
8.6
base score, highest
EPSS
0.002
10th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
5
of 17,781 indexed, latest versions
Container images
4
deployed by those charts
Fix available
1 of 1
affected package

Helm has a path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory

Carried by container images the latest versions of 5 of 17,781 indexed charts deploy, on 4 images.

Affected packageAffected versionsFixed inImages
helm.sh/helm/v4golangv4.1.0, v4.1.34.1.44
OSV records
GHSA-vmx8-mqv2-9gmg
Also known as
BIT-helm-2026-35204, GO-2026-5666

Charts affected

5 by stars
ChartLatestAffected imagesRadar Score
pulsarapache4.7.01 of 10See more

pulsar apache 4.7.0

1 of the 10 container images this version deploys carry CVE-2026-35204.

Container imageDigestPackageFixed in
alpine/k8s:1.32.12048f8d9c8cc7
helm.sh/helm/v4@v4.1.0
4.1.4

Open the chart page →

9,864
release-cleanerhelm-release-cleanerVerified publisher1.0.01 of 1See more

release-cleaner helm-release-cleaner 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-35204.

Container imageDigestPackageFixed in
alpine/helm:4.1.0905a068da431
helm.sh/helm/v4@v4.1.0
4.1.4

Open the chart page →

2,000
kagentkagent0.10.11 of 6See more

kagent kagent 0.10.1

1 of the 6 container images this version deploys carry CVE-2026-35204.

Container imageDigestPackageFixed in
ghcr.io/kagent-dev/kagent/tools:0.2.150b431281d3e
helm.sh/helm/v4@v4.1.3
4.1.4

Open the chart page →

2,900
tenant-namespace-operatorpnnl-miscscripts0.1.281 of 1See more

tenant-namespace-operator pnnl-miscscripts 0.1.28

1 of the 1 container images this version deploys carry CVE-2026-35204.

Container imageDigestPackageFixed in
pnnlmiscscripts/tenant-namespace-operator:0.1.24-18af4b7551d40
helm.sh/helm/v4@v4.1.0
4.1.4

Open the chart page →

12,754
rybbitrybbit-helm1.3.01 of 7See more

rybbit rybbit-helm 1.3.0

1 of the 7 container images this version deploys carry CVE-2026-35204.

Container imageDigestPackageFixed in
alpine/k8s:1.32.12048f8d9c8cc7
helm.sh/helm/v4@v4.1.0
4.1.4

Open the chart page →

5,819

Container images carrying it

4 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
alpine/k8s:1.32.12048f8d9c8cc7
helm.sh/helm/v4@v4.1.0
4.1.4
2
alpine/helm:4.1.0905a068da431
helm.sh/helm/v4@v4.1.0
4.1.4
1
pnnlmiscscripts/tenant-namespace-operator:0.1.24-18af4b7551d40
helm.sh/helm/v4@v4.1.0
4.1.4
1
ghcr.io/kagent-dev/kagent/tools:0.2.150b431281d3e
helm.sh/helm/v4@v4.1.3
4.1.4
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.